It is possible to traverse the directories on the server by encondig '\' as '%5c', this allows an attacker to browse all files on the server.

Solution
There is no patch. The only work around is to install a "reverse" proxy, that will filter all incoming requests to the webserver. It might also be possible to place the webdirectory on a different harddrive (d:) rather than the system disk (typical c:), it does not appear to be possible to supply a drive letter.

Provided and/or discovered by
UkR-XblP / UkR security team http://ust.dp.ua/

Deep Links
Links available to Secunia VIM customers